Shapley-Guided Neural Repair Approach via Derivative-Free Optimization

Xinyu Sun; Wanwei Liu; Haoang Chi; Tingyu Chen; Xiaoguang Mao; Shangwen Wang; Lei Bu; Jingyi Wang

cs.SEApr 1, 2026

Shapley-Guided Neural Repair Approach via Derivative-Free Optimization

Authors: Xinyu Sun, Wanwei Liu, Haoang Chi, Tingyu Chen, Xiaoguang Mao, Shangwen Wang, Lei Bu, Jingyi Wang,

Organizations: National University of Defense Technology, Changsha, Hunan, China · Nanjing University, Nanjing, Jiangsu, China · Zhejiang University, Hangzhou, Zhejiang, China

Abstract

DNNs are susceptible to defects like backdoors, adversarial attacks, and unfairness, undermining their reliability. Existing approaches mainly involve retraining, optimization, constraint-solving, or search algorithms. However, most methods rely on gradient calculations, restricting applicability to specific activation functions (e.g., ReLU), or use search algorithms with uninterpretable localization and repair. Furthermore, they often lack generalizability across multiple properties. We propose SHARPEN, integrating interpretable fault localization with a derivative-free optimization strategy. First, SHARPEN introduces a Deep SHAP-based localization strategy quantifying each layer's and neuron's marginal contribution to erroneous outputs. Specifically, a hierarchical coarse-to-fine approach reranks layers by aggregated impact, then locates faulty neurons/filters by analyzing activation divergences between property-violating and benign states. Subsequently, SHARPEN incorporates CMA-ES to repair identified neurons. CMA-ES leverages a covariance matrix to capture variable dependencies, enabling gradient-free search and coordinated adjustments across coupled neurons. By combining interpretable localization with evolutionary optimization, SHARPEN enables derivative-free repair across architectures, being less sensitive to gradient anomalies and hyperparameters. We demonstrate SHARPEN's effectiveness on three repair tasks. Balancing property repair and accuracy preservation, it outperforms baselines in backdoor removal (+10.56%), adversarial mitigation (+5.78%), and unfairness repair (+11.82%). Notably, SHARPEN handles diverse tasks, and its modular design is plug-and-play with different derivative-free optimizers, highlighting its flexibility.

Figures & tables

Figure 1. Motivation of SHARPEN . (A) Dilemma: Methods trade off between blind exploration and unscalable rigid constraints. (B) Insight: Recognizing that neural network faults often suffer from sparse critical neurons, we leverage interpretability to constrain the search space, transforming high-dimensional optimization into a local problem. (C) Goal: Achieving utility-preserved repair , satisfying the property ( $V(f^{\prime})\leq\tau$ ) while preserving accuracy ( $\Delta Acc\leq\epsilon$ ).

Figure 2. The overall workflow of SHARPEN .

Figure 3. The workflow of Deep SHAP-based coarse-to-fine fault localization.

Figure 4. Examples of backdoor attacks (BadNet, Blend, and WaNet) on an ImageNet10 “tench/goldfish” image.

Figure 5. Layer contribution analysis for the BadNets removal case study on VGG16.

Figure 6. Example of neuron contribution analysis for the BadNets removal task on conv5_1 and FC2 of VGG16.

Figure 7. Example of channel-level heatmap analysis for the BadNets removal task on conv5_1 of VGG16.

Panel A: Image Tasks
Model	BadNet		Blend		WaNet		FGSM
Model	BSR(%)	ACC (%)	BSR(%)	ACC (%)	BSR(%)	ACC (%)	ASR(%)	ACC (%)
VGG13-CIFAR10	97.25	86.07	98.84	86.22	94.47	85.64	80.00	87.58
VGG16-ImageNet10	94.64	90.67	99.82	88.17	84.28	87.46	–	–
ResNet18-GTSRB	99.38	86.89	99.88	86.08	92.82	87.93	70.00	98.98

Table 1. Initial accuracy and property metrics of unrepaired models on image and tabular tasks.

Model	Method	BadNet			Blend			WaNet			Avg
Model	Method	$\Delta_{BSR}$	$\Delta_{ACC}$	Score	$\Delta_{BSR}$	$\Delta_{ACC}$	Score	$\Delta_{BSR}$	$\Delta_{ACC}$	Score	Score
	CARE	-97.90	-13.42	84.48	-98.18	-5.43	92.75	-97.75	1.56	99.31	92.18
	AI-Lancet	-100.00	-71.64	28.36	-99.80	-83.30	16.50	-92.38	1.12	93.50	46.12
	IR	-97.49	-17.96	79.53	-96.06	-27.70	68.36	-100.00	-4.02	95.98	81.29
	APRNN	-98.20	-10.29	87.91	-99.90	-1.66	98.24	-92.63	0.67	93.30	93.15
	INNER	-92.79	-9.28	83.51	-96.26	-14.50	81.76	-82.13	-0.22	81.91	82.39

Table 2. Effectiveness of SHARPEN compared to baselines on backdoor removal.

Method	VGG13-CIFAR10		ResNet18-GTSRB		VGG16-ImageNet10		Avg
Method	Locating(s)	Repair(s)	Locating(s)	Repair(s)	Locating(s)	Repair(s)	Total(s)
CARE	43	466	46	543	34324	5543	13655
AI-Lancet	3228	0	3567	0	811	0	2535.3
IR	4	8	20	19	1196	305	517.3
APRNN	0	315	0	189	0	1447	650.3
INNER	226	146	315	154	389	229	486.3

Table 3. Time cost comparison of different backdoor removal methods (measured in seconds).

Method	VGG13-CIFAR10			ResNet18-GTSRB			Avg
Method	$\Delta_{ASR}\%$	$\Delta_{ACC}\%$	Score	$\Delta_{ASR}\%$	$\Delta_{ACC}\%$	Score	Score
CARE	-90.10	-2.05	88.05	-96.20	-2.04	94.16	91.11
AI-Lancet	-59.50	-1.26	58.24	-27.90	-1.92	25.98	42.11
IR	-99.90	-14.38	85.52	-86.20	-7.93	78.27	81.90
APRNN	-68.60	-0.57	68.03	-96.70	-33.98	62.72	65.38
INNER	-72.20	-0.11	72.09	-99.50	-10.19	89.31	80.70

Table 4. Effectiveness of SHARPEN compared to baselines on adversarial repair.

Dataset	Feat.	CARE			PRDNN			ADF			IDNN			SHARPEN
Dataset	Feat.	$\Delta_{UF}\%$	$\Delta_{ACC}\%$	Score	$\Delta_{UF}\%$	$\Delta_{ACC}\%$	Score	$\Delta_{UF}\%$	$\Delta_{ACC}\%$	Score	$\Delta_{UF}\%$	$\Delta_{ACC}\%$	Score	$\Delta_{UF}\%$	$\Delta_{ACC}\%$	Score
Census	Race	-70.67	-3.49	67.18	-23.39	-1.71	21.68	-47.52	-1.84	45.68	-79.39	-4.37	75.02	-90.80	-2.37	88.43
Census	Gender	-35.94	-3.13	32.81	-12.67	-1.43	11.24	-43.23	-2.03	41.20	-72.22	-4.53	67.69	-57.14	-0.28	56.86
Census	Age	-47.24	-4.05	43.19	-32.90	-3.47	29.43	-39.11	-2.50	36.61	-73.16	-4.91	68.25	-79.09	-1.45	77.64
Credit	Gender	-21.74	-0.84	20.90	-11.10	-0.55	10.55	-31.53	-1.87	29.66	-54.76	-2.68	52.08	-73.83	-3.06	70.77
Credit	Age	-45.17	-0.57	44.60	4.05	-1.97	-6.02	-36.04	-2.76	33.28	-62.25	-3.36	58.89	-89.40	-2.04	87.36

Table 5. Effectiveness of SHARPEN compared to baselines on fairness repair.

Figure 8. Effect of the top-

K

neurons on repair performance for VGG13-CIFAR10-BadNets .

Figure 9. Sensitivity analysis of the repair objective weights on VGG13-CIFAR10-BadNets .

Task	Random			SHARPEN (Bottom- $k$ )			SHARPEN (Top- $k$ )
Task	$\Delta_{Prop}$	$\Delta_{ACC}$	$S_{c}$	$\Delta_{Prop}$	$\Delta_{ACC}$	$S_{c}$	$\Delta_{Prop}$	$\Delta_{ACC}$	$S_{c}$
BadNets-VGG13	-0.51	-1.53	-1.02	-0.05	-0.14	-0.09	-99.12	-0.60	98.52
FGSM-VGG13	-0.48	-0.66	-0.18	-0.66	-0.06	0.60	-95.00	-0.66	94.34
Race-Census	-36.36	-1.54	34.82	-16.67	-3.05	13.62	-90.80	-2.37	88.43

Table 6. Ablation on localization strategies.

Dataset	Feat.	SHARPEN -CMA		SHARPEN -RACOS
Dataset	Feat.	$\Delta_{UF}\%$	$\Delta_{ACC}\%$	$\Delta_{UF}\%$	$\Delta_{ACC}\%$
Census	Race	-90.80	-2.37	-93.51	-4.80
Census	Gender	-57.14	-0.28	-97.22	-3.33
Census	Age	-79.09	-1.45	-68.42	-0.85
Credit	Gender	-73.83	-3.06	-80.33	-2.04
Credit	Age	-89.40	-2.04	-97.51	-4.08

Table 7. Comparison of fairness and accuracy percentage changes using different derivative-free optimizers.

Backdoor Defense

Backdoor defense develops methods to detect, remove, or contain hidden trigger-conditioned behaviors in machine-learning models.

See all 50 papers

Provable Fairness Repair for Deep Neural Networks
May 19, 2026Jianan Ma, Jingyi Wang, Qi Xuan +1Algorithmic Fairness
Hangzhou Dianzi University, China · Zhejiang University, China · Zhejiang University of Technology, China
Fast Preemptive Robustification: High-Frequency Response Anti-Aligns Shared Vulnerability
Mar 26, 2026Jiaming Liang, Chi-Man PunNeural Network Robustness Adversarial Robustness
University of Macau, Macau, China
WARP: Guaranteed Inner-Layer Repair of NLP Transformers
Apr 1, 2026Hsin-Ling Hsu, Min-Yu Chen, Nai-Chia Chen +3Adversarial Robustness of Language Models Certified Robustness
Department of Management Information Systems, National Chengchi University

May 19, 2026J/K move · Enter open · S save

Provable Fairness Repair for Deep Neural Networks

Jianan Ma, Jingyi Wang, Qi Xuan, Zhen Wang

Hangzhou Dianzi University, China · Zhejiang University, China · Zhejiang University of Technology, China

Algorithmic Fairness

Open paper AskPDF arXiv

Deep neural networks (DNNs) are suffering from ethical issues such as individual discrimination. In response, extensive NN repair techniques have been developed to adjust models and mitigate such undesired behaviors. However, existing fairness repair methods are typically data-centric, which often lack provable guarantees and generalization to unseen samples. To overcome these limitations, we propose ProF, a novel fairness repair framework with provable guarantees. The key intuition of ProF is to leverage interval bound propagation (a widely used NN verification technique) to soundly capture model outputs over the whole set

S(\mathbf{x})

around a biased sample

\mathbf{x}

. The derived bounds are utilized to guide fairness repair which encourages the model to produce consistent outputs on

S(\mathbf{x})

. Specifically, we integrate fairness constraints and model modifications into a unified constraint-solving formulation, which can be transformed to a Mixed-Integer Linear Programming (MILP) problem solvable by off-the-shelf solvers. The solution to the MILP problem effectively induces a repaired model with guaranteed fairness over the whole set

S(\mathbf{x})

. We evaluate ProF on four widely used benchmark datasets and demonstrate that it achieves provable fairness repair, with generalization of up to 95.93% on full datasets and 93.16% on the entire input space. Notably, ProF can be easily configured to support multiple sensitive attributes and more practical fairness definitions, while providing provable repair guarantees and delivering around 90% fairness improvement. Our code is available at https://github.com/nninjn/ProF.

Abstract

Backdoor Defense

Explore similar work

Provable Fairness Repair for Deep Neural Networks

Fast Preemptive Robustification: High-Frequency Response Anti-Aligns Shared Vulnerability

WARP: Guaranteed Inner-Layer Repair of NLP Transformers